ML22034A014

NRR E-mail Capture - Audit Plan Supplement for LIM 50.69 LAR (L-2021-LLA-0042)

ML22034A014
Person / Time
Site:	Limerick
Issue date:	02/02/2022
From:	Audrey Klett NRC/NRR/DORL/LPL1
To:	Stewart G Constellation Energy Generation
Klett A
References
L-2021-LLA-0042
Download: ML22034A014 (14)

Text

From: Klett, Audrey Sent: Wednesday, February 2, 2022 8:04 AM To: Stewart, Glenn H:(Exelon Nuclear)

Subject:

Audit Plan Supplement for LIM 50.69 LAR (L-2021-LLA-0042)

Attachments: Revised and New Limerick Audit Questions - L-2021-LLA-0042.docx

Hi Glenn, Attached are the revised and new audit questions resulting from the audit call held in November 2021. Revisions appear in tracked changes of the set of questions dated October 20, 2021.

Please let me know if you need any clarifications of the questions or format. Ill call you to discuss dates for a follow-up audit call to discuss Constellations responses to these questions.

Thanks,

-Audrey Klett

Hearing Identifier: NRR_DRMA Email Number: 1506

Mail Envelope Properties (BLAPR09MB60677192660672DAB04BBB6187279)

Subject:

Audit Plan Supplement for LIM 50.69 LAR (L-2021-LLA-0042)

Sent Date: 2/2/2022 8:03:47 AM Received Date: 2/2/2022 8:03:00 AM From: Klett, Audrey

Created By: Audrey.Klett@nrc.gov

Recipients:

"Stewart, Glenn H:(Exelon Nuclear)" <Glenn.Stewart@exeloncorp.com>

Tracking Status: None

Post Office: BLAPR09MB6067.namprd09.prod.outlook.com

Files Size Date & Time MESSAGE 421 2/2/2022 8:03:00 AM Revised and New Limerick Audit Questions - L-2021-LLA-0042.docx 80803

Options Priority: Normal Return Notification: No Reply Requested: No Sensitivity: Normal Expiration Date:

Addendum A - Draft Audit Questions

ADDITIONAL AUDIT INFORMATION REQUESTS TO SUPPORT THE REVIEW OF LICENSE AMENDMENT REQUEST

CHANGES TO LICENSE CONDITIONS RE. 10 CFR 50.69

CONSTELLATION ENERGY GENERATION, LLC

LIMERICK GENERATING STATION, UNITS 1 AND 2

DOCKETS NO. 50-352 AND 50-353

This set of audit requests includes new questions and revised questions from the original set sent to the licensee on October 21, 2021 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML21295A035). Revisions (deletions and additions) are shown for each question, as applicable, in tracked changes. Questions from the original set that are not discussed in this revised set remain as audit questions.

Questions on Alternative Seismic Approach

Question 01 - Completeness of Information Describing the Proposed Alternate Seismic Approach

If the licensee answers the new APLC audit questions (ADAMS Accession No. ML22028A183) satisfactorily, then the NRC no longer needs this audit question.

Question 02 - Relative Contribution of Seismic Risk for 10 CFR 50.69 Categorization

The NRC expects that this question will not be applicable because of the supplement dated December 15, 2021 (ADAMS Accession No. ML21349B364). If the licensee answers the new APLC audit questions (ADAMS Accession No. ML22028A183) satisfactorily, then the NRC no longer needs this audit question.

Question 03 - Use of Different Approaches for Seismic Risk Consideration in 10 CFR 50.69 Categorization

If the licensee answers the new APLC audit questions (ADAMS Accession No. ML22028A183) satisfactorily, then the NRC no longer needs this audit question.

Questions on Alternate Categorization Methodology for Pressure Boundary Components

Question 05 - Prerequisite No. 1 - PRA Technical Adequacy Internal Flooding Model

[No changes to the background information, and no changes to parts B, C, or F]

A. Clarify which LGS PRA model (i.e., RG 1.200 or RI -ISI) will be utilized in the alternate passive categorization process. Include in this discussion whether this requirement is applicable to the internal events model (FPIE).

D. Provide a summary of changes, if any, performed in the FPIE and IFPRA to support the alternate passive categorization method.

E. Section 4 of NEI 00-04, 10 CFR 50.69, SSC Categorization Guideline, states the classification of SSCs with a pressure retaining function should be performed using the ASME Code Case N-660 or, as stated in RG 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance, alternatives that have received specific NRC approval for the 10 CFR 50.69 categorization program. Section I-3 of the Case N-660 states that indirect effects shall be assessed, and Section I-3.1.3(a)(4) provides HSS criteria related to indirect effects. Sections I-3.0.1, I-3.1.1, and I-3.2.2 of the ANO-2-R&R-004, Revision 1 alternative pressure categorization state that indirect effects, which include spatial interactions such as pipe whip, jet spray, and loss-of-inventory effects (e.g., draining), be assessed in determining the SSCs categorization.

During the NRCs audit, the licensee mentioned that indirect effects are addressed in the plants safety analyses. The NRC staff notes that the FPIE and IFPRA analysis usually may not explicitly incorporate indirect effects. For example, supporting requirement IFSN-A6, as updated by NRC endorsement in RG 1.200, at Capability Category II allows for qualitative assessment of flood induced mechanisms:

for the SSCs identified in IFSN-A5, IDENTIFY the suscepti bility of each SSC in a flood area to flood-induced failure mechanisms. INCLUDE failure for submergence and spray in the identification process. ASSES qualitatively the impact of flood-induced mechanisms that are not formally addressed (e.g., using the mechanisms listed under Capability Category III of this requirement), by using conservative assumptions.

Further, the proposed EPRI methodology does not mention indirect effects.

Discuss how comprehensive the FPIE and IFPRA analysis is to model indirect effects (e.g., pipe whip, jet impingement, spray, inventory losses, etc.) and drain capacity and credited operator actions and justify why it is adequate to support the 10 CFR 50.69 categorization process.

G. [New question] During the audit, the licensee stated that the LGS IFPRA uses the EPRI Topical Report (TR) 002000079, Pipe Rupture Frequencies for Internal Flooding PRAs, Revision 3, for the pipe break frequencies.

Provide an overview of the EPRI TR-002000079 report and discuss its basis. Discuss both rupture frequencies and assumed break sizes. Justify why it is believed to be adequate to support the 10 CFR 50.69 categorization process.

Question 09 - Alternate Passive Categorization MethodologyPre-determined HSS SSCs Criteria

[No changes to the background information, and no changes to Parts A, B, C.i-iv, and D. Part E moved to Question 10.]

A.1 [New question (similar to original Question 05.B.ii)] Table 4-1 of EPRI 3002015999 appears to provide the basis for the list of predetermined HSS SSCs. The basis criteria appear to include consistency with the current (ANO-2) passive categorization process and industry insights from the RI-ISI program. Items Nos. 8 through 10 appear to rely on engineering judgement and experience. It is unclear to the NRC staff if the proposed alternate method is sufficiently comprehensive to identify all the necessary HSS SSCs given the apparent reliance on insights, judgements, and experience.

Provide justification that the EPRI determination of predetermined HSS SSCs is comprehensive and adequate to identify all SSCs that should be HSS.

C. [no changes to introductory text, no changes to parts i through iv]

v. [New Question] During the audit, the licensee provided a list of IF scenarios that describe the flood type (i.e., spray, flood, or major flood), the flood area, and the system sources (e.g., fire protection and service water). The NRC staff understands that the IF PRA analysis allows this breakdown if there is a difference in plant impact, such as different SSCs impacted or operator action timing. However, the passive categorization process, as described in NEI 00-04, assesses the entire impact of a passive SSC. This process, for example, would include the aggregate spray, flood, and major flood impacts. It is unclear to the NRC staff how Criterion Nos. 11, 12, and 13, which appear to evaluate scenario specific risk, adequately evaluate the total risk associated with an SSC. Therefore:

Either justify that splitting the impacts of a single passive SSC into multiple scenarios and evaluating on a single scenario basis adequately assesses the cumulative risk impact of that SSC for Criterion Nos. 11, 12, and 13; or propose a mechanism to ensure the alternate proposed method assesses the cumulative impact of a passive SSC.

E. [Moved to Question 10 and revised.]

F. [New question] Table 3-1 of the EPRI report lists a number of alternatives considered for alternate passive component categorization and identifies limitations and challenges associated of each of the considered alternatives. Some identified limitations include the need to address standby system pressure boundary failures and spatial effects.

Describe whether and how the self-identified limitations are addressed by the proposed alternate passive categorization methodology. If not addressed, justify why they have no impact on the 50.69 categorization.

Question 10 - Pressure Boundary D-I-D

[No changes to background information]

A. For utilizing the alternate EPRI 3002015999 alternate pressure boundary method, pProvide justification for how each pressure boundary component that is categorized LSS is evaluated maintaining the defense-in-depth philosophy.

B. If not all the passive SSCs categorized as LSS are not evaluated for defense-in-depth, then provide justification that the exclusion of these SSCs from defense-in-depth consideration does not adversely impact the categorization process.

C. [New Question, relocated from Question 09.E and revised] The NRC-accepted ANO-2 R&R-004 method for SSC categorization describes a two -stage categorization process. In the first stage, PRA analyses (or a series of tables which are equivalent to PRA analyses) are used to identify HSS SSCs. In the second stage, licensee personnel re-evaluate the remaining potentially LSS segments. For each segment, qualitative considerations are addressed through a series of conditions or questions. The responses to these questions support the systematic determination on whether SSCs that are not assigned HSS by the quantitative PRA results should, nevertheless, be assigned HSS based on qualitative considerations. In contrast, the proposed alternate method does not appear to address any qualitative considerations. Therefore:

i. Provide justification that the exclusion of the ANO-2 R&R-004 qualitative criteria does not adversely impact the 50.69 categorization process.

ii. Describe how those SSCs not explicitly modeled in the PRA are to be categorized.

D. [New question] During the audit, the licensee stated that if a pressure boundary SSC can fail a critical safety function, t hen it will be designated HSS. However, the staff notes that containment bypass scenarios (e.g., ISLOCAs) can result in the failure of the containment safety function. Table I-4 of the ANO-2 alternate pressure boundary process (also Code Case N-660) identifies containment bypass events based on failure type and number, resulting in High or Medium. ASME Code Case N -716-1 does not appear to take into consideration passive failures that lead directly to containment bypass. Section 6.2 of NEI 00-04 states that containment bypass events, such as ISLOCAs for BWRs, are important challenges to LERF risk, and that the licensee should automatically designate an SSC as candidate HSS if it can initiate an ISLOCA.

Provide justification why specific guidance on containment bypass events, such as ISLOCAs, is not necessary for the alternate passive categorization.

E. [New question] Provide justification that passive SSCs whose failures could result in containment bypass should not be classified as candidate HSS.

[New Question (continued from original set numbering)] Question 16 - Sources of Uncertainty

Sections 50.69(c)(1)(i) and 50.69(c)(1)(ii) of 10 CFR require that a licensees PRA be of sufficient quality and level of detail to support the SSC categorization process, and that all aspects of the integrated, systematic process used to characterize SSC importance must reasonably reflect the current plant configuration and operating practices, and applicable plant and industry operational experience.

The guidance in Section 5 of NEI 00-04, as endorsed by RG 1.201, Revision 1, stipulates identification of any applicable sensitivity studies to be used during the categorization process that are associated with the licensees choice of specific models and assumptions, as discussed in RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk -Informed Decisions on Plant-Specific Changes to the Licensing Basis.

The staff notes that the guidance in NEI 00-04 stipulates identification of any applicable sensitivity studies to be used during the categorization process that are associated with the licensees choice of specific PRA models and assumptions, as discussed in RG 1.174, to address uncertainty. The sensitivity studies are performed to ensure that assumptions and sources of uncertainty (e.g., human error, common cause failure, and maintenance probabilities) do not mask the importance of SSCs.

The approved ANO-2 methodology for categorization on passive pressure-retaining components is a consequence-based method and assumes a large pressure boundary failure.

In contrast, the alternative EPRI approach proposes to use the internal flooding PRA model with built-in initiating event frequencies, assumed pipe break sizes, screening of flooding sources and flooding scenarios, credit for drains, doors, and human actions. The PRA assumptions and sources of uncertainty could have an impact on the categorization results from the proposed alternative passive categorization method. The EPRI report does not discuss any consideration of PRA uncertainty. Therefore:

A. Justify that the proposed passive methodology does not necessitate consideration of PRA assumptions and sources of uncertainty or alternatively, describe the process to identify key sources of uncertainty related to the proposed alternate passive categorization method.

B. Provide a list of identified sources of uncertainty related to the proposed method.

Include in this discussion how the LGS categorization program will address these items.

[New Question (continued from original set numbering) ] Question 17 - Interfacing System LOCA (ISLOCA) Flooding Considerations

Section 50.69(b)(2)(ii) of 10 CFR requires that a license amendment request (LAR) include a description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown are adequate for the categorization of SSCs. Section 50.69(b)(2)(iv) of 10 CFR requires that a LAR include a description of, and basis for acceptability of, the evaluations to be conducted to satisfy 10 CFR 50.69(c)(1)(iv). The Statement of Consideration (SoC) on 10 CFR 50.69(b)(2)(iv) of the Final Rule states that the licensee is required to include information about the evaluations they intend to conduct to provide reasonable confidence that the potential increase in risk would be small. The SoC further clarifies that a licensee must provide sufficient information to the NRC describing the risk sensitivity study and other evaluations and the basis for their acceptability while appropriately representing the potential increase in risk from implementation of the requirements in the rule.

ISLOCA events do not seem to be typically incorporated in the IF analysis but could have an additional IF impact besides impacting water inventory and bypassing containment, as captured in the FPIE PRA. During the audit, the licensee demonstrated being below the risk thresholds of the proposed method by splitting the IE ISLOCA sequence initiators on a system basis.

Therefore:

A. Discuss how the LGS FPIE model incorporates the IF aspect for the ISLOCA scenarios.

B. If not modeled, then provide justification that the exclusion of the IF impact of ISLOCA events does not adversely impact the 50.69 categorization.

C. Alternatively to Part (B), propose a mechanism to ensure that the IF impact associated with ISLOCAs are incorporated into the LGS FPIE model prior to using the alternate EPRI pressure boundary categorization method.

D. Provide justification for performing risk impact determination by splitting the ISLOCA scenario on a system basis. Justify why the approach does not impact the 10 CFR 50.69 categorization.

Questions on Alternate Defense-in-Depth Categorization Process

Question 12 - Core Damage Defense in Depth Cutset Filteringsteps

[New background information] Section 50.69(b)(2)(ii) of 10 CFR requires, in part, that a LAR include a description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown are adequate for the categorization of SSCs.

A. [no changes to background or parts i and ii]

iii. [New question] Further discuss the criteria used for filtering the cutsets. Justify why the proposed method cutset filtering is adequate to assess all DID aspects in determining significance.

A.1 [New question] PRA models have additional approximations, such as capacity factors, phenomenological events, and split fractions, built into the model. The 2009 PRA Standard, regarding SR AS-B3, states that phenomenological conditions that impact the success of the system or function to be included in the models. The failure of an SSC directly attributed to an event (e.g., seismic or flooding) are failed by the initiating event basic event. During the audit, the licensee stated that certain elements (i.e., phenomenological events which may be related to the failure of SSCs) are ignored as basic events (BEs) in the cutset screening. The treatment of these events is unclear to the NRC staff and may be inconsistent.

Provide the basis for the proposed alternate method not crediting phenomenological failures as SSCs in the cutset review.

A.2 [New question] The considerations for maintaining DID in RG 1.174 include preventing overreliance on programmatic activities (Consideration No. 2) and preserving sufficient defense against human errors (Consideration No. 6). The proposed method would only identify HSS categorization cutsets that went to core damage because of a failure of single operator action. Secondly, credit for repair or recovery in the PRA model would result in LSS categorization for SSCs that are in cutsets with repair and recovery actions. Therefore:

i. Explain the type of recovery and repair actions credited in the Limerick PRA.

ii. Explain and justify how the credit for recovery and repair actions in the PRA impacts the cutset screening (filtering) criteria for DID and how it is consistent with the RG 1.174 DID considerations.

iii. Explain how the Limerick PRA models joint human error probabilities (JHEPs).

iv. Explain and justify how the JHEP modeling impacts the cutset screening (fi ltering) criteria for DID and how it is consistent with the RG 1.174 DID considerations.

A.3. [New question] Based on audit discussions, the NRC staff understands that the proposed alternate categorization process categorizes SSCs as HSS only when there is no backup to the SSC failure (e.g., an initiator with only one SSC failure that leads to core damage is considered a single point failure). The licensee clarified during the audit that this method performs its analysis at the SSC level and not the func tional level.

Section 6.1 of NEI 00-04 performs the DID analysis at the functional level in order to identify all the SSCs that support that function (i.e., safety-critical functions) and what events can cause their simultaneous failure. For example, a loss of alternating or direct current bus initiator or a loss of service water cooling initiator can leave one train available for the injection function and a separate train available for the cooling function, and would result in HSS categorization for both trains.

i. Provide justification for events that leave only one SSC available for the required functions to avoid core damage are not designated as HSS.

ii. Regarding SSCs that are directly failed by the initiating event that do not have a basic event associated with a failure elsewhere in the cutset listing, provide justification on why those SSCs are not categorized as HSS in the first order cutset review.

B. Step 7.a.2 of PWROG-20015-NP states the following with regards to common cause failures (CCFs): Common cause failure groups that are greater than or equal to four can be screened out of the filtered cutsets. Justify the rationale for excluding common cause failure groups of 4 or more. [New Questions] During the regulatory audit, the licensee explained that a CCF of 4 or more components is screened out of the filtered cutsets, but a failure of 2 or 3 components out of a group of 4 or more is maintained in the filtered cutsets for DID. The rationale provided during the audit was that a CCF of 3 components or less is included in the filtered cutsets to maintain consistency with the guidance in the NEI 00-04 DID matrix, which required 3 trains or less as a function of the frequency of the initiating event. The NRC staff notes that the DID matrix appears to be at the system train level, which assumes 100 percent train capacity for mitigation, while CCF groups may not map directly to system trains. Therefore:

i. Provide a list of SSCs modeled in the LGS PRA that have four or more SSCs in their common cause grouping.

ii. Provide justification for excluding from the filtered cutsets those containing basic events that represent CCFs of 4 or more components.

C. Step 7.b of PWROG-20015-NP states the following with regard to cutset quantitative screening: Cutsets with initiating events with frequencies that are less than 1E-04 per year are not included in the alternate core damage defense-in-depth categorization process and can be screened out of the filtered cutsets.

During the audit, the licensee provided a list of several IF initiators associated with the same system, such as the battery room area, that were split based on their flooding type (e.g., spray, flood, major flood). It is unclear how the proposed method assesses the DID impact of a specific SSC if the combined IEF of their associated scenarios for a specific hazard (e.g., internal flooding and fire) is above the 1E-04 per year threshold.

i. Discuss whether and how uncertainty in initiating event frequency is taken into account in the alternate defense-in-depth categorization.

ii. Discuss how it is assured that initiating events would not be split into multiple initiating events of lower frequencies.

iii. List all initiating events in the Limerick PRA that have an initiating event frequency less than 1E-4 per year.

iv. [New question] Discuss how the proposed method considers the cumulative DID impact of a specific SSC when its associated individual scenario IEFs are below the 1E-04 per year threshold.

D. [No changes]

E. [New question] As a potential sensitivity study, explain the impact on the results of the categorization if the screening criterion was increased to two or three elements (i.e., basic events) for both core damage and containment DID cases.

Question 13 - Defense-in-Depth First Order Core Damage Cutset Approach

[No changes to background information, and no change to Part A.]

B. [Question removed]

C.1 [Original part C replaced with the following] RG 1.174, Revision 3, states that risk-informed implementation changes are permitted for small increases in risk when the maintenance of sufficient defense in depth is reasonably assured. Item 3 of Section 2.2.5 of PWROG-20015-NP, Revision 1, states, regarding compliance with RG 1.174, that system redundancy, independence, and diversity are preserved since no system design modifications are made by the proposed alternate method. The NRC staff notes that RG 1.174 states that the preservation is in the context of the expected frequency and consequences of challenges to the system. The PWROG method appears to consider the frequency of challenges ; however, it does not appear to consider the reliability of systems responding to those challenges.

During the audit, the licensee stated that the proposed use of first order cutsets (i.e., those with a single SSC failure) is consistent with the safety analysis single failure criterion (i.e., core damage or large early releases can be avoided for design events and one SSC failure). Sections 6.2.1.1.3.3 (regarding containment accident response analysis) and 6.3.1.1.2 (regarding core damage) of the Limerick updated final safety analysis report (UFSAR) appear to demonstrate the need for multiple layers of SSCs in responding to design accidents. For example, Case A analysis in Section 6.2.1.1.3.3.1.6 (regarding long-term accident responses) assumes the availability of HPCI, core spray, and all LPCI pumps. With regards to ECCS scenarios,

Part d of Section 6.3.1.1.2 has combinations of LPCI, CS, ADS, and HPCI with some systems having a multiple loop requirement.

As shown in Figure 6-1 of NEI 00-04, not all layers of DID should be categorized as HSS. However, it is unclear to the NRC staff why only SSCs that provide one layer of DID are categorized as HSS, especially when there is no apparent reliability consideration in the proposed alternate method (e.g., SSCs with high failure rates such as the shared function of the safety-related HPCI train and non-safety RCIC train).

Therefore:

i. Provide justification on how the first order cutset meets the RG 1.174 requirement to identify essential SSCs that preserve the required level of DID based on challenges to the responding systems.

ii. Provide justification how the first order cutset criterion takes into consideration the reliability of systems in determining the number of layers of DID in responding to plant challenges. Include in this discussion how the proposed approach is consistent with the Limerick UFSAR in identifying the required number of layers of DID for design events.

iii. Explain how the reliability of each layer of DID is taken into consideration by the proposed method. Include in this discussion justification why an SSC is not categorized as HSS when it has only one backup to avoid core damage is an SSC with significant unavailability and reliability.

C.2. [New question] The NRC staff notes the licensees demonstration of the alternate DID method presented during the audit identified approximately 34 cutsets in what appeared to be in the 1E-11 per year CDF range. A typical PRA analysis quantitatively results in thousands of cutsets in the 1E-11 range, which are usually not in the top 100 high frequency contributors to CDF and, therefore, not risk-significant. It is unclear to the NRC staff how the proposed method uses risk significant cutsets when identifying HSS SSCs.

Provide justification how the proposed method incorporates risk -significant cutsets in its categorization process. Include in this discussion why there are no apparent specified consideration of the most risk significant cutsets (i.e., 1E-06 to 1E-07 per year) in the proposed method.

C.3. [New question] DID consideration Item 3 of RG 1.174 states that diversity is accomplished by having equipment that performs the same function rely on different attributes, such as different principles of operation, different physical variables, different conditions of operation. It further states that diversity is required when high availability and reliability of a function is required so that a single design feature does not fail that function. Section 2.2.5 of PWROG -20015-NP states that the diversity requirement is not impacted since there are no plant modifications resulting from the categorization.

i. Provide details of how the proposed method identifies and assesses the DID diversity requirement for risk-significant scenarios.

ii. Provide justification that this method meets the RG 1.174 consideration of preserving system redundancy, independence, and diversity commensurate with the expected frequency and consequences of challenges to the system, including consideration of uncertainty.

D. Table 4 of the LAR supplement dated May 5, 2021 (ADAMS Accession No. ML21125A215), provides the functions identified as HSS by the alternate method, including the low-pressure core injection mode and suppression pool cooling mode of the residual heat removal system and providing air or gas to the automatic depression system relief valves or other steam relief valves. These functions appear to be backup or support functions to other primary functions (e.g., feedwater, reactor core isolation cooling, and high-pressure injection). Therefore, it appears the associated accident sequences for these functions would be represented in cutsets with two or more basic events. It is unclear to the NRC staff how these functions were determined to be HSS by the first order method of the alternate approach.

Explain and justify how the functions provided in Table 4 of the supplement dated May 5, 2021, were determined by the alternate method using first order cutsets.

E. [no change]

F. [New question] R.G. 1.174, Revision 3, Section C.2.1.1.3, Evaluating the Impact of the Proposed Licensing Basis Change on Defense in Depth, states, in part:

.. to address the unknown and unforeseen failure mechanisms or phenomena, the licensees evaluation of this defense-in-depth consideration should also address insights based on traditional engineering approaches. Results and insights of the risk assessment might be used to support the conclusion; however, the results and insights of the risk assessment should not be the only basis for justifying that this defense-in-depth consideration is met. The licensee should consider the impact of the proposed licensing basis change on each of the layers of defense.

Explain how the proposed DID methodology addresses this concern.

G. [New question] RG 1.174 DID Consideration Item No. 1, reasonable balance among the layers of defense, states that the context of layers of defense is to prevent any events from progressing to core damage. Section 6.1 of NEI 00-04, regarding core damage DID, states that internally initiated design basis events considered in the licensees safety analysis report are to assess their appropriate DID requirements for categorization. The NRC staff notes that Section 8.3.2.1.1.2 of the Limerick UFSAR identifies other design basis event fires (e.g., safe shutdown and SBO).

Section 7.1.2.7.11 of the UFSAR states that electrical train system separation is based on credible events, such as pipe ruptures and fires, and Section 7.3.2.1.2.2.3 addresses the fire protection system and its design basis.

Section 2.2.2 of PWROG-20015-NP states that only the FPIE PRA model is used for the proposed alternate method. It is unclear to the NRC staff why this method excludes other hazard PRA models (e.g., internal flooding, fire) when they represent events that lead to core damage.

Provide justification that the exclusion of other hazard PRA models from the alternate DID method is consistent with the RG 1.174 DID consideration of addressing any event that leads to core damage and the NEI 00-04 requirement for internally initiated design related events.

Question 14 - Defense-in-Depth First Order Large Early Release Cutset Approach and Screening

[No changes to background information]

A. [revised question (parts i and ii have been replaced)] Step 8.b.1 of the PWROG guidance states to only filter cutsets with a single BE (e.g., SSC failure, CCF, or HFE) that leads to containment failure. The NRC staff notes that core damage cutsets that lead to a plant damage state (PDS) that can proceeding to a large early release event usually contains one or more failuresmore than one failure; typically at least one failure leading to core damage and one failure related to loss of containment. It is unclear to the NRC staff if the containment defense -in-depth approach applies the filtering process to the core damage cutset failures or to the containment-related failures.

During the audit, the licensee clarified that only basic events representing failures that resulted in both core damage and large early release would be screened for HSS consideration. The Limerick pilot of the proposed alternate method did not identify any SSCs as HSS for the containment defense in depth.

Provide justification that the proposed method for defense in depth is in accordance with the seven defense-in-depth considerations of RG 1.174, with particular emphasis on items 1 (i.e., preserve reasonable balance among the layers of defense) and 5 (i.e., maintain multiple fission product barriers).

B. [no change]

C. Step 8.b.2.a of the PWROG guidance states that cutsets with IEFs less than 1E -04 per year may be screened from the alternate defense -in-depth approach. Section 6.2 of NEI 00-04 provides guidance for considering containment bypass, such as intersystem LOCAs (ISLOCAs), considerations in determining passive SSC categorization.

Containment bypass events usually have an IEF < 1E -04/year, yet they are significant contributors to LERF risk since they bypass the containment. It is unclear to the staff how the PWROG alternate approach includes this consideration in the categorization of passive SSCs related to containment bypass. Therefore:

i. [no change]

ii. Provide justification that the screening of a containment bypass events or containment bypass isolation failure associated with an IEF < 1E-04/year does not adversely impact the categoroization process is consistent with the seven DID RG 1.174 considerations. Include in this discussion how the thrid layer of defense for public health and safety is bypassed.

iii. [removed]

D. [no change]

E. [removed]

.